@kensio/yulin 1.18.2 → 1.19.0

package/dist/service/cognito/command/auth/sim-cognito-challenge-responses.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-challenge-responses.js","sourceRoot":"","sources":["../../../../../src/service/cognito/command/auth/sim-cognito-challenge-responses.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,4BAA4B,EAC5B,8BAA8B,GAC/B,MAAM,iCAAiC,CAAC;AAazC;;;;;;GAMG;AACH,MAAM,OAAO,4BAA4B;IACtB,WAAW,CAAgC;IAC3C,GAAG,CAAwB;IAE5C,YAAY,UAAkD;QAC5D,IAAI,CAAC,WAAW,GAAG,UAAU,CAAC,WAAW,CAAC;QAC1C,IAAI,CAAC,GAAG,GAAG,UAAU,CAAC,GAAG,CAAC;IAC5B,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,MAAM,CACV,aAAiC,EACjC,OAA2C;QAE3C,MAAM,SAAS,GAAG,8BAA8B,CAAC,aAAa,CAAC,CAAC;QAEhE,IAAI,SAAS,KAAK,4BAA4B,EAAE,CAAC;YAC/C,OAAO,MAAM,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAChD,CAAC;QAED,OAAO,MAAM,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,GAAG,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,CAAC,CAAC;IACzE,CAAC;CACF"}
+{"version":3,"file":"sim-cognito-challenge-responses.js","sourceRoot":"","sources":["../../../../../src/service/cognito/command/auth/sim-cognito-challenge-responses.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,4BAA4B,EAC5B,8BAA8B,GAC/B,MAAM,iCAAiC,CAAC;AACzC,OAAO,EACL,2BAA2B,EAC3B,2BAA2B,GAC5B,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EAAE,yBAAyB,EAAE,MAAM,yCAAyC,CAAC;AAepF;;GAEG;AACH,MAAM,qBAAqB,GAAwB,IAAI,GAAG,CAAC;IACzD,yBAAyB;IACzB,2BAA2B;IAC3B,2BAA2B;CAC5B,CAAC,CAAC;AAEH;;;;;;GAMG;AACH,MAAM,OAAO,4BAA4B;IACtB,WAAW,CAAgC;IAC3C,GAAG,CAAwB;IAC3B,WAAW,CAAgC;IAE5D,YAAY,UAAkD;QAC5D,IAAI,CAAC,WAAW,GAAG,UAAU,CAAC,WAAW,CAAC;QAC1C,IAAI,CAAC,GAAG,GAAG,UAAU,CAAC,GAAG,CAAC;QAC1B,IAAI,CAAC,WAAW,GAAG,UAAU,CAAC,WAAW,CAAC;IAC5C,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,MAAM,CACV,aAAiC,EACjC,OAA2C;QAE3C,MAAM,SAAS,GAAG,8BAA8B,CAAC,aAAa,CAAC,CAAC;QAEhE,IAAI,SAAS,KAAK,4BAA4B,EAAE,CAAC;YAC/C,OAAO,MAAM,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAChD,CAAC;QAED,IAAI,qBAAqB,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;YACzC,OAAO,MAAM,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC;gBACnC,GAAG,OAAO;gBACV,aAAa,EAAE,SAAS;aACzB,CAAC,CAAC;QACL,CAAC;QAED,OAAO,MAAM,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,GAAG,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,CAAC,CAAC;IACzE,CAAC;CACF"}

package/dist/service/cognito/command/auth/sim-cognito-first-factor-challenge.d.ts

@@ -0,0 +1,54 @@
+import type { SimClock } from "../../../../util/clock/sim-clock.js";
+import type { SimCognitoUserPoolClient } from "../../user-pool/client/sim-cognito-user-pool-client.js";
+import type { SimCognitoUserPool } from "../../user-pool/sim-cognito-user-pool.js";
+import type { SimCognitoUser } from "../../user-pool/user/sim-cognito-user.js";
+import type { SimCognitoAuthenticationOutput } from "./auth.command.js";
+/**
+ * The challenge a pool answers a choice-based sign-in with when the request
+ * named no preference.
+ */
+export declare const simCognitoSelectChallenge = "SELECT_CHALLENGE";
+interface SimCognitoFirstFactorChallengeProperties {
+    readonly clock: SimClock;
+}
+/**
+ * A sign-in that has found its user and has a factor left to ask for.
+ */
+export interface SimCognitoFirstFactorRequest {
+    readonly pool: SimCognitoUserPool;
+    readonly client: SimCognitoUserPoolClient;
+    readonly user: SimCognitoUser;
+}
+/**
+ * The first factor a `USER_AUTH` sign-in asks for.
+ *
+ * A request naming no `PREFERRED_CHALLENGE` is answered with
+ * `SELECT_CHALLENGE` and the factors this user could present, and the caller
+ * picks one through `RespondToAuthChallenge`. A request naming one is answered
+ * with that challenge directly. Either way the answer carries a session, and
+ * `SimCognitoFirstFactorResponse` is what completes it.
+ */
+export declare class SimCognitoFirstFactorChallenge {
+    private readonly clock;
+    constructor(properties: SimCognitoFirstFactorChallengeProperties);
+    /**
+     * Answer with the factors this user could present, and a session to come
+     * back with.
+     */
+    offer(request: SimCognitoFirstFactorRequest): SimCognitoAuthenticationOutput;
+    /**
+     * Answer with one named factor, or refuse one this sign-in cannot offer.
+     */
+    issue(request: SimCognitoFirstFactorRequest, challengeName: string, field: string): SimCognitoAuthenticationOutput;
+    /**
+     * Ask for a passkey, carrying the options a browser presents one against.
+     *
+     * The options live on the session as well as in the answer, because the
+     * challenge inside them is what the credential coming back has to sign.
+     */
+    private presentPasskey;
+    private answer;
+    private remember;
+}
+export {};
+//# sourceMappingURL=sim-cognito-first-factor-challenge.d.ts.map

package/dist/service/cognito/command/auth/sim-cognito-first-factor-challenge.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-first-factor-challenge.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/command/auth/sim-cognito-first-factor-challenge.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qCAAqC,CAAC;AAEpE,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,wDAAwD,CAAC;AAKvG,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0CAA0C,CAAC;AACnF,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,0CAA0C,CAAC;AAQ/E,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,mBAAmB,CAAC;AAExE;;;GAGG;AACH,eAAO,MAAM,yBAAyB,qBAAqB,CAAC;AAE5D,UAAU,wCAAwC;IAChD,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;CAC1B;AAED;;GAEG;AACH,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAC;IAClC,QAAQ,CAAC,MAAM,EAAE,wBAAwB,CAAC;IAC1C,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;CAC/B;AAED;;;;;;;;GAQG;AACH,qBAAa,8BAA8B;IACzC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAW;IAEjC,YAAY,UAAU,EAAE,wCAAwC,EAE/D;IAED;;;OAGG;IACH,KAAK,CAAC,OAAO,EAAE,4BAA4B,GAAG,8BAA8B,CAO3E;IAED;;OAEG;IACH,KAAK,CACH,OAAO,EAAE,4BAA4B,EACrC,aAAa,EAAE,MAAM,EACrB,KAAK,EAAE,MAAM,GACZ,8BAA8B,CAchC;IAED;;;;;OAKG;IACH,OAAO,CAAC,cAAc;IA4BtB,OAAO,CAAC,MAAM;IAcd,OAAO,CAAC,QAAQ;CAmBjB"}

package/dist/service/cognito/command/auth/sim-cognito-first-factor-challenge.js

@@ -0,0 +1,87 @@
+import { SimCognitoAuthSession } from "../../user-pool/auth/sim-cognito-auth-session.js";
+import { requireSimCognitoRelyingParty, simCognitoUserVerification, } from "../../user-pool/mfa/sim-cognito-relying-party.js";
+import { simCognitoWebAuthnRequestOptions } from "../../user-pool/user/web-authn/sim-cognito-web-authn-assertion.js";
+import { requireSimCognitoAvailableChallenge, simCognitoAvailableChallenges, simCognitoWebAuthnChallenge, } from "./sim-cognito-available-challenges.js";
+/**
+ * The challenge a pool answers a choice-based sign-in with when the request
+ * named no preference.
+ */
+export const simCognitoSelectChallenge = "SELECT_CHALLENGE";
+/**
+ * The first factor a `USER_AUTH` sign-in asks for.
+ *
+ * A request naming no `PREFERRED_CHALLENGE` is answered with
+ * `SELECT_CHALLENGE` and the factors this user could present, and the caller
+ * picks one through `RespondToAuthChallenge`. A request naming one is answered
+ * with that challenge directly. Either way the answer carries a session, and
+ * `SimCognitoFirstFactorResponse` is what completes it.
+ */
+export class SimCognitoFirstFactorChallenge {
+    clock;
+    constructor(properties) {
+        this.clock = properties.clock;
+    }
+    /**
+     * Answer with the factors this user could present, and a session to come
+     * back with.
+     */
+    offer(request) {
+        const { pool, user } = request;
+        return {
+            ...this.answer(request, simCognitoSelectChallenge),
+            AvailableChallenges: [...simCognitoAvailableChallenges(pool, user)],
+        };
+    }
+    /**
+     * Answer with one named factor, or refuse one this sign-in cannot offer.
+     */
+    issue(request, challengeName, field) {
+        const { pool, user } = request;
+        requireSimCognitoAvailableChallenge(challengeName, simCognitoAvailableChallenges(pool, user), field);
+        if (challengeName === simCognitoWebAuthnChallenge) {
+            return this.presentPasskey(request);
+        }
+        return this.answer(request, challengeName);
+    }
+    /**
+     * Ask for a passkey, carrying the options a browser presents one against.
+     *
+     * The options live on the session as well as in the answer, because the
+     * challenge inside them is what the credential coming back has to sign.
+     */
+    presentPasskey(request) {
+        const { pool, client, user } = request;
+        const options = simCognitoWebAuthnRequestOptions(requireSimCognitoRelyingParty(pool), simCognitoUserVerification(pool), user.webAuthn.credentials.map((each) => each.descriptor()));
+        const session = this.remember(pool, client, user, simCognitoWebAuthnChallenge, options);
+        return {
+            $metadata: {},
+            ChallengeName: simCognitoWebAuthnChallenge,
+            Session: session.id,
+            ChallengeParameters: {
+                USERNAME: user.username,
+                CREDENTIAL_REQUEST_OPTIONS: JSON.stringify(options),
+            },
+        };
+    }
+    answer(request, challengeName) {
+        const { pool, client, user } = request;
+        return {
+            $metadata: {},
+            ChallengeName: challengeName,
+            Session: this.remember(pool, client, user, challengeName).id,
+            ChallengeParameters: { USERNAME: user.username },
+        };
+    }
+    remember(pool, client, user, challengeName, webAuthnOptions) {
+        const session = new SimCognitoAuthSession({
+            username: user.username,
+            client,
+            challengeName,
+            issuedAt: this.clock.now(),
+            webAuthnOptions,
+        });
+        pool.auth.addSession(session);
+        return session;
+    }
+}
+//# sourceMappingURL=sim-cognito-first-factor-challenge.js.map

package/dist/service/cognito/command/auth/sim-cognito-first-factor-challenge.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-first-factor-challenge.js","sourceRoot":"","sources":["../../../../../src/service/cognito/command/auth/sim-cognito-first-factor-challenge.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,qBAAqB,EAAE,MAAM,kDAAkD,CAAC;AAEzF,OAAO,EACL,6BAA6B,EAC7B,0BAA0B,GAC3B,MAAM,kDAAkD,CAAC;AAG1D,OAAO,EAAE,gCAAgC,EAAE,MAAM,mEAAmE,CAAC;AAErH,OAAO,EACL,mCAAmC,EACnC,6BAA6B,EAC7B,2BAA2B,GAC5B,MAAM,uCAAuC,CAAC;AAG/C;;;GAGG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,kBAAkB,CAAC;AAe5D;;;;;;;;GAQG;AACH,MAAM,OAAO,8BAA8B;IACxB,KAAK,CAAW;IAEjC,YAAY,UAAoD;QAC9D,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC;IAChC,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,OAAqC;QACzC,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,OAAO,CAAC;QAE/B,OAAO;YACL,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,yBAAyB,CAAC;YAClD,mBAAmB,EAAE,CAAC,GAAG,6BAA6B,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;SACpE,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,KAAK,CACH,OAAqC,EACrC,aAAqB,EACrB,KAAa;QAEb,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,OAAO,CAAC;QAE/B,mCAAmC,CACjC,aAAa,EACb,6BAA6B,CAAC,IAAI,EAAE,IAAI,CAAC,EACzC,KAAK,CACN,CAAC;QAEF,IAAI,aAAa,KAAK,2BAA2B,EAAE,CAAC;YAClD,OAAO,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC;QACtC,CAAC;QAED,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;IAC7C,CAAC;IAED;;;;;OAKG;IACK,cAAc,CACpB,OAAqC;QAErC,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,OAAO,CAAC;QACvC,MAAM,OAAO,GAAG,gCAAgC,CAC9C,6BAA6B,CAAC,IAAI,CAAC,EACnC,0BAA0B,CAAC,IAAI,CAAC,EAChC,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC,CAC3D,CAAC;QACF,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAC3B,IAAI,EACJ,MAAM,EACN,IAAI,EACJ,2BAA2B,EAC3B,OAAO,CACR,CAAC;QAEF,OAAO;YACL,SAAS,EAAE,EAAE;YACb,aAAa,EAAE,2BAA2B;YAC1C,OAAO,EAAE,OAAO,CAAC,EAAE;YACnB,mBAAmB,EAAE;gBACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,0BAA0B,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;aACpD;SACF,CAAC;IACJ,CAAC;IAEO,MAAM,CACZ,OAAqC,EACrC,aAAqB;QAErB,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,OAAO,CAAC;QAEvC,OAAO;YACL,SAAS,EAAE,EAAE;YACb,aAAa,EAAE,aAAa;YAC5B,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,CAAC,CAAC,EAAE;YAC5D,mBAAmB,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE;SACjD,CAAC;IACJ,CAAC;IAEO,QAAQ,CACd,IAAwB,EACxB,MAAgC,EAChC,IAAoB,EACpB,aAAqB,EACrB,eAAkD;QAElD,MAAM,OAAO,GAAG,IAAI,qBAAqB,CAAC;YACxC,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,MAAM;YACN,aAAa;YACb,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE;YAC1B,eAAe;SAChB,CAAC,CAAC;QAEH,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;QAE9B,OAAO,OAAO,CAAC;IACjB,CAAC;CACF"}

package/dist/service/cognito/command/auth/sim-cognito-first-factor-response.d.ts

@@ -0,0 +1,55 @@
+import type { SimClock } from "../../../../util/clock/sim-clock.js";
+import type { SimCognitoAuthResolver } from "./sim-cognito-auth-resolver.js";
+import { type SimCognitoFirstFactorChallenge } from "./sim-cognito-first-factor-challenge.js";
+import type { SimCognitoChallengeResponseRequest } from "./sim-cognito-new-password-response.js";
+import type { SimCognitoPasswordResponse } from "./sim-cognito-password-response.js";
+import type { SimCognitoWebAuthnResponse } from "./sim-cognito-web-authn-response.js";
+import type { SimCognitoAuthenticationOutput } from "./auth.command.js";
+interface SimCognitoFirstFactorResponseProperties {
+    readonly authResolver: SimCognitoAuthResolver;
+    readonly challenge: SimCognitoFirstFactorChallenge;
+    readonly password: SimCognitoPasswordResponse;
+    readonly webAuthn: SimCognitoWebAuthnResponse;
+    readonly clock: SimClock;
+}
+/**
+ * A response to one of the challenges a `USER_AUTH` sign-in issues.
+ */
+export interface SimCognitoFirstFactorResponseRequest extends SimCognitoChallengeResponseRequest {
+    readonly challengeName: string;
+}
+/**
+ * Answering the first factor of a choice-based sign-in.
+ *
+ * `SELECT_CHALLENGE` is answered with an `ANSWER` naming the factor the user
+ * picked. Picking `WEB_AUTHN` is answered with that challenge and the options
+ * a passkey is presented against, and picking `PASSWORD` carries the password
+ * in the same request and finishes the sign-in, which is how the Cognito
+ * documentation shows both.
+ *
+ * `PASSWORD` and `WEB_AUTHN` are what a sign-in that named a
+ * `PREFERRED_CHALLENGE` is answered with, and each is completed here.
+ *
+ * A session is spent when the challenge it carries has been got past, and a
+ * refusal leaves it standing, so a wrong password or a passkey the person
+ * cancelled can be answered again. That is what real Cognito does with the
+ * MFA challenges, and this holds the first factors to the same rule.
+ */
+export declare class SimCognitoFirstFactorResponse {
+    private readonly authResolver;
+    private readonly challenge;
+    private readonly password;
+    private readonly webAuthn;
+    private readonly clock;
+    constructor(properties: SimCognitoFirstFactorResponseProperties);
+    /**
+     * Answer whichever of the three challenges the request names.
+     */
+    handle(request: SimCognitoFirstFactorResponseRequest): Promise<SimCognitoAuthenticationOutput>;
+    /**
+     * Act on the factor a `SELECT_CHALLENGE` response picked.
+     */
+    private chosen;
+}
+export {};
+//# sourceMappingURL=sim-cognito-first-factor-response.d.ts.map

package/dist/service/cognito/command/auth/sim-cognito-first-factor-response.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-first-factor-response.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/command/auth/sim-cognito-first-factor-response.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qCAAqC,CAAC;AAQpE,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AAC7E,OAAO,EAEL,KAAK,8BAA8B,EACpC,MAAM,yCAAyC,CAAC;AACjD,OAAO,KAAK,EAAE,kCAAkC,EAAE,MAAM,wCAAwC,CAAC;AACjG,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,oCAAoC,CAAC;AACrF,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,qCAAqC,CAAC;AACtF,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,mBAAmB,CAAC;AAExE,UAAU,uCAAuC;IAC/C,QAAQ,CAAC,YAAY,EAAE,sBAAsB,CAAC;IAC9C,QAAQ,CAAC,SAAS,EAAE,8BAA8B,CAAC;IACnD,QAAQ,CAAC,QAAQ,EAAE,0BAA0B,CAAC;IAC9C,QAAQ,CAAC,QAAQ,EAAE,0BAA0B,CAAC;IAC9C,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;CAC1B;AAED;;GAEG;AACH,MAAM,WAAW,oCAAqC,SAAQ,kCAAkC;IAC9F,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;CAChC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,qBAAa,6BAA6B;IACxC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAyB;IACtD,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAiC;IAC3D,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA6B;IACtD,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA6B;IACtD,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAW;IAEjC,YAAY,UAAU,EAAE,uCAAuC,EAM9D;IAED;;OAEG;IACG,MAAM,CACV,OAAO,EAAE,oCAAoC,GAC5C,OAAO,CAAC,8BAA8B,CAAC,CAgBzC;IAED;;OAEG;YACW,MAAM;CAyBrB"}

package/dist/service/cognito/command/auth/sim-cognito-first-factor-response.js

@@ -0,0 +1,64 @@
+import { requireSimCognitoAnsweringUser } from "./sim-cognito-answering-user.js";
+import { simCognitoPasswordChallenge, simCognitoWebAuthnChallenge, } from "./sim-cognito-available-challenges.js";
+import { simCognitoSelectChallenge, } from "./sim-cognito-first-factor-challenge.js";
+/**
+ * Answering the first factor of a choice-based sign-in.
+ *
+ * `SELECT_CHALLENGE` is answered with an `ANSWER` naming the factor the user
+ * picked. Picking `WEB_AUTHN` is answered with that challenge and the options
+ * a passkey is presented against, and picking `PASSWORD` carries the password
+ * in the same request and finishes the sign-in, which is how the Cognito
+ * documentation shows both.
+ *
+ * `PASSWORD` and `WEB_AUTHN` are what a sign-in that named a
+ * `PREFERRED_CHALLENGE` is answered with, and each is completed here.
+ *
+ * A session is spent when the challenge it carries has been got past, and a
+ * refusal leaves it standing, so a wrong password or a passkey the person
+ * cancelled can be answered again. That is what real Cognito does with the
+ * MFA challenges, and this holds the first factors to the same rule.
+ */
+export class SimCognitoFirstFactorResponse {
+    authResolver;
+    challenge;
+    password;
+    webAuthn;
+    clock;
+    constructor(properties) {
+        this.authResolver = properties.authResolver;
+        this.challenge = properties.challenge;
+        this.password = properties.password;
+        this.webAuthn = properties.webAuthn;
+        this.clock = properties.clock;
+    }
+    /**
+     * Answer whichever of the three challenges the request names.
+     */
+    async handle(request) {
+        const { session, user } = requireSimCognitoAnsweringUser(this.authResolver, request, this.clock.now());
+        if (request.challengeName === simCognitoWebAuthnChallenge) {
+            return await this.webAuthn.complete(request, session, user);
+        }
+        if (request.challengeName === simCognitoSelectChallenge) {
+            return await this.chosen(request, session, user);
+        }
+        return await this.password.complete(request, session, user);
+    }
+    /**
+     * Act on the factor a `SELECT_CHALLENGE` response picked.
+     */
+    async chosen(request, session, user) {
+        const answer = request.parameters.require("ANSWER");
+        if (answer === simCognitoPasswordChallenge) {
+            return await this.password.complete(request, session, user);
+        }
+        const { pool, client } = request;
+        const issued = this.challenge.issue({ pool, client, user }, answer, "ANSWER");
+        // The choice is spent once it has been made, and the factor it picked is
+        // what the next session is for. A choice this sign-in could not offer
+        // leaves it standing, so the caller can pick again.
+        pool.auth.removeSession(session);
+        return issued;
+    }
+}
+//# sourceMappingURL=sim-cognito-first-factor-response.js.map

package/dist/service/cognito/command/auth/sim-cognito-first-factor-response.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-first-factor-response.js","sourceRoot":"","sources":["../../../../../src/service/cognito/command/auth/sim-cognito-first-factor-response.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,8BAA8B,EAAE,MAAM,iCAAiC,CAAC;AACjF,OAAO,EACL,2BAA2B,EAC3B,2BAA2B,GAC5B,MAAM,uCAAuC,CAAC;AAE/C,OAAO,EACL,yBAAyB,GAE1B,MAAM,yCAAyC,CAAC;AAqBjD;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,OAAO,6BAA6B;IACvB,YAAY,CAAyB;IACrC,SAAS,CAAiC;IAC1C,QAAQ,CAA6B;IACrC,QAAQ,CAA6B;IACrC,KAAK,CAAW;IAEjC,YAAY,UAAmD;QAC7D,IAAI,CAAC,YAAY,GAAG,UAAU,CAAC,YAAY,CAAC;QAC5C,IAAI,CAAC,SAAS,GAAG,UAAU,CAAC,SAAS,CAAC;QACtC,IAAI,CAAC,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC;QACpC,IAAI,CAAC,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC;QACpC,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC;IAChC,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,MAAM,CACV,OAA6C;QAE7C,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,8BAA8B,CACtD,IAAI,CAAC,YAAY,EACjB,OAAO,EACP,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CACjB,CAAC;QAEF,IAAI,OAAO,CAAC,aAAa,KAAK,2BAA2B,EAAE,CAAC;YAC1D,OAAO,MAAM,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;QAC9D,CAAC;QAED,IAAI,OAAO,CAAC,aAAa,KAAK,yBAAyB,EAAE,CAAC;YACxD,OAAO,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;QACnD,CAAC;QAED,OAAO,MAAM,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;IAC9D,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,MAAM,CAClB,OAA6C,EAC7C,OAA8B,EAC9B,IAAoB;QAEpB,MAAM,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QAEpD,IAAI,MAAM,KAAK,2BAA2B,EAAE,CAAC;YAC3C,OAAO,MAAM,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;QAC9D,CAAC;QAED,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;QACjC,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CACjC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,EACtB,MAAM,EACN,QAAQ,CACT,CAAC;QAEF,yEAAyE;QACzE,sEAAsE;QACtE,oDAAoD;QACpD,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;QAEjC,OAAO,MAAM,CAAC;IAChB,CAAC;CACF"}

package/dist/service/cognito/command/auth/sim-cognito-mfa-challenge.js

@@ -58,7 +58,7 @@ export class SimCognitoMfaChallenge {
         const code = factor === simCognitoSmsMfa ? simCognitoMfaCode() : undefined;
         const session = new SimCognitoAuthSession({
             username: user.username,
-            clientId: client.id,
+            client,
             challengeName: factor,
             code,
             issuedAt: this.clock.now(),

package/dist/service/cognito/command/auth/sim-cognito-mfa-challenge.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-mfa-challenge.js","sourceRoot":"","sources":["../../../../../src/service/cognito/command/auth/sim-cognito-mfa-challenge.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,qBAAqB,EAAE,MAAM,kDAAkD,CAAC;AAIzF,OAAO,EAAE,gBAAgB,EAAE,MAAM,qDAAqD,CAAC;AAEvF,OAAO,EAAE,yBAAyB,EAAE,MAAM,oCAAoC,CAAC;AAC/E,OAAO,EACL,2BAA2B,EAC3B,iBAAiB,GAClB,MAAM,2BAA2B,CAAC;AAmBnC;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,OAAO,sBAAsB;IAChB,SAAS,CAA0B;IACnC,KAAK,CAAW;IAEjC,YAAY,UAA4C;QACtD,IAAI,CAAC,SAAS,GAAG,UAAU,CAAC,SAAS,CAAC;QACtC,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC;IAChC,CAAC;IAED;;;;;;OAMG;IACK,MAAM,CAAC,kBAAkB,CAC/B,MAAc,EACd,IAAoB;QAEpB,MAAM,WAAW,GAAG,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;QAE7D,IAAI,MAAM,KAAK,gBAAgB,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;YAC7D,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,OAAO;YACL,6BAA6B,EAAE,KAAK;YACpC,yBAAyB,EAAE,2BAA2B,CAAC,WAAW,CAAC;SACpE,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,QAAQ,CACZ,OAAsC;QAEtC,MAAM,MAAM,GAAG,yBAAyB,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;QAErE,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,OAAO,CAAC;QACvC,MAAM,IAAI,GAAG,MAAM,KAAK,gBAAgB,CAAC,CAAC,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;QAC3E,MAAM,OAAO,GAAG,IAAI,qBAAqB,CAAC;YACxC,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,QAAQ,EAAE,MAAM,CAAC,EAAE;YACnB,aAAa,EAAE,MAAM;YACrB,IAAI;YACJ,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE;SAC3B,CAAC,CAAC;QAEH,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;QAE9B,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;gBACxB,IAAI;gBACJ,MAAM;gBACN,IAAI;gBACJ,QAAQ,EAAE,gBAAgB;gBAC1B,IAAI;gBACJ,cAAc,EAAE,OAAO,CAAC,cAAc;aACvC,CAAC,CAAC;QACL,CAAC;QAED,OAAO;YACL,SAAS,EAAE,EAAE;YACb,aAAa,EAAE,MAAM;YACrB,OAAO,EAAE,OAAO,CAAC,EAAE;YACnB,mBAAmB,EAAE;gBACnB,eAAe,EAAE,IAAI,CAAC,QAAQ;gBAC9B,GAAG,sBAAsB,CAAC,kBAAkB,CAAC,MAAM,EAAE,IAAI,CAAC;aAC3D;SACF,CAAC;IACJ,CAAC;CACF"}
+{"version":3,"file":"sim-cognito-mfa-challenge.js","sourceRoot":"","sources":["../../../../../src/service/cognito/command/auth/sim-cognito-mfa-challenge.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,qBAAqB,EAAE,MAAM,kDAAkD,CAAC;AAIzF,OAAO,EAAE,gBAAgB,EAAE,MAAM,qDAAqD,CAAC;AAEvF,OAAO,EAAE,yBAAyB,EAAE,MAAM,oCAAoC,CAAC;AAC/E,OAAO,EACL,2BAA2B,EAC3B,iBAAiB,GAClB,MAAM,2BAA2B,CAAC;AAmBnC;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,OAAO,sBAAsB;IAChB,SAAS,CAA0B;IACnC,KAAK,CAAW;IAEjC,YAAY,UAA4C;QACtD,IAAI,CAAC,SAAS,GAAG,UAAU,CAAC,SAAS,CAAC;QACtC,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC;IAChC,CAAC;IAED;;;;;;OAMG;IACK,MAAM,CAAC,kBAAkB,CAC/B,MAAc,EACd,IAAoB;QAEpB,MAAM,WAAW,GAAG,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;QAE7D,IAAI,MAAM,KAAK,gBAAgB,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;YAC7D,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,OAAO;YACL,6BAA6B,EAAE,KAAK;YACpC,yBAAyB,EAAE,2BAA2B,CAAC,WAAW,CAAC;SACpE,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,QAAQ,CACZ,OAAsC;QAEtC,MAAM,MAAM,GAAG,yBAAyB,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;QAErE,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,OAAO,CAAC;QACvC,MAAM,IAAI,GAAG,MAAM,KAAK,gBAAgB,CAAC,CAAC,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;QAC3E,MAAM,OAAO,GAAG,IAAI,qBAAqB,CAAC;YACxC,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,MAAM;YACN,aAAa,EAAE,MAAM;YACrB,IAAI;YACJ,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE;SAC3B,CAAC,CAAC;QAEH,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;QAE9B,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;gBACxB,IAAI;gBACJ,MAAM;gBACN,IAAI;gBACJ,QAAQ,EAAE,gBAAgB;gBAC1B,IAAI;gBACJ,cAAc,EAAE,OAAO,CAAC,cAAc;aACvC,CAAC,CAAC;QACL,CAAC;QAED,OAAO;YACL,SAAS,EAAE,EAAE;YACb,aAAa,EAAE,MAAM;YACrB,OAAO,EAAE,OAAO,CAAC,EAAE;YACnB,mBAAmB,EAAE;gBACnB,eAAe,EAAE,IAAI,CAAC,QAAQ;gBAC9B,GAAG,sBAAsB,CAAC,kBAAkB,CAAC,MAAM,EAAE,IAAI,CAAC;aAC3D;SACF,CAAC;IACJ,CAAC;CACF"}

package/dist/service/cognito/command/auth/sim-cognito-new-password-challenge.d.ts

@@ -1,4 +1,5 @@
 import type { SimClock } from "../../../../util/clock/sim-clock.js";
+import type { SimCognitoUserPoolClient } from "../../user-pool/client/sim-cognito-user-pool-client.js";
 import type { SimCognitoUserPool } from "../../user-pool/sim-cognito-user-pool.js";
 import type { SimCognitoUser } from "../../user-pool/user/sim-cognito-user.js";
 import type { SimCognitoAuthenticationOutput } from "./auth.command.js";
@@ -7,7 +8,7 @@ interface SimCognitoNewPasswordChallengeProperties {
 }
 interface SimCognitoChallengeProperties {
     readonly pool: SimCognitoUserPool;
-    readonly clientId: string;
+    readonly client: SimCognitoUserPoolClient;
     readonly user: SimCognitoUser;
 }
 /**

package/dist/service/cognito/command/auth/sim-cognito-new-password-challenge.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-new-password-challenge.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/command/auth/sim-cognito-new-password-challenge.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qCAAqC,CAAC;AAEpE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0CAA0C,CAAC;AACnF,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,0CAA0C,CAAC;AAE/E,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,mBAAmB,CAAC;AAExE,UAAU,wCAAwC;IAChD,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;CAC1B;AAED,UAAU,6BAA6B;IACrC,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAC;IAClC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;CAC/B;AAED;;;;;GAKG;AACH,qBAAa,8BAA8B;IACzC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAW;IAEjC,YAAY,UAAU,EAAE,wCAAwC,EAE/D;IAED;;OAEG;IACH,KAAK,CACH,UAAU,EAAE,6BAA6B,GACxC,8BAA8B,CAqBhC;CACF"}
+{"version":3,"file":"sim-cognito-new-password-challenge.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/command/auth/sim-cognito-new-password-challenge.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qCAAqC,CAAC;AAEpE,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,wDAAwD,CAAC;AACvG,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0CAA0C,CAAC;AACnF,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,0CAA0C,CAAC;AAE/E,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,mBAAmB,CAAC;AAExE,UAAU,wCAAwC;IAChD,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;CAC1B;AAED,UAAU,6BAA6B;IACrC,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAC;IAClC,QAAQ,CAAC,MAAM,EAAE,wBAAwB,CAAC;IAC1C,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;CAC/B;AAED;;;;;GAKG;AACH,qBAAa,8BAA8B;IACzC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAW;IAEjC,YAAY,UAAU,EAAE,wCAAwC,EAE/D;IAED;;OAEG;IACH,KAAK,CACH,UAAU,EAAE,6BAA6B,GACxC,8BAA8B,CAqBhC;CACF"}

package/dist/service/cognito/command/auth/sim-cognito-new-password-challenge.js

@@ -15,10 +15,10 @@ export class SimCognitoNewPasswordChallenge {
      * Answer with `NEW_PASSWORD_REQUIRED` and a session.
      */
     issue(properties) {
-        const { pool, clientId, user } = properties;
+        const { pool, client, user } = properties;
         const session = new SimCognitoAuthSession({
             username: user.username,
-            clientId,
+            client,
             challengeName: newPasswordRequiredChallenge,
             issuedAt: this.clock.now(),
         });

package/dist/service/cognito/command/auth/sim-cognito-new-password-challenge.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-new-password-challenge.js","sourceRoot":"","sources":["../../../../../src/service/cognito/command/auth/sim-cognito-new-password-challenge.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,qBAAqB,EAAE,MAAM,kDAAkD,CAAC;AAGzF,OAAO,EAAE,4BAA4B,EAAE,MAAM,iCAAiC,CAAC;AAa/E;;;;;GAKG;AACH,MAAM,OAAO,8BAA8B;IACxB,KAAK,CAAW;IAEjC,YAAY,UAAoD;QAC9D,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC;IAChC,CAAC;IAED;;OAEG;IACH,KAAK,CACH,UAAyC;QAEzC,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,UAAU,CAAC;QAC5C,MAAM,OAAO,GAAG,IAAI,qBAAqB,CAAC;YACxC,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,QAAQ;YACR,aAAa,EAAE,4BAA4B;YAC3C,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE;SAC3B,CAAC,CAAC;QAEH,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;QAE9B,OAAO;YACL,SAAS,EAAE,EAAE;YACb,aAAa,EAAE,4BAA4B;YAC3C,OAAO,EAAE,OAAO,CAAC,EAAE;YACnB,mBAAmB,EAAE;gBACnB,eAAe,EAAE,IAAI,CAAC,QAAQ;gBAC9B,kBAAkB,EAAE,IAAI;gBACxB,cAAc,EAAE,IAAI;aACrB;SACF,CAAC;IACJ,CAAC;CACF"}
+{"version":3,"file":"sim-cognito-new-password-challenge.js","sourceRoot":"","sources":["../../../../../src/service/cognito/command/auth/sim-cognito-new-password-challenge.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,qBAAqB,EAAE,MAAM,kDAAkD,CAAC;AAIzF,OAAO,EAAE,4BAA4B,EAAE,MAAM,iCAAiC,CAAC;AAa/E;;;;;GAKG;AACH,MAAM,OAAO,8BAA8B;IACxB,KAAK,CAAW;IAEjC,YAAY,UAAoD;QAC9D,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC;IAChC,CAAC;IAED;;OAEG;IACH,KAAK,CACH,UAAyC;QAEzC,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,UAAU,CAAC;QAC1C,MAAM,OAAO,GAAG,IAAI,qBAAqB,CAAC;YACxC,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,MAAM;YACN,aAAa,EAAE,4BAA4B;YAC3C,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE;SAC3B,CAAC,CAAC;QAEH,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;QAE9B,OAAO;YACL,SAAS,EAAE,EAAE;YACb,aAAa,EAAE,4BAA4B;YAC3C,OAAO,EAAE,OAAO,CAAC,EAAE;YACnB,mBAAmB,EAAE;gBACnB,eAAe,EAAE,IAAI,CAAC,QAAQ;gBAC9B,kBAAkB,EAAE,IAAI;gBACxB,cAAc,EAAE,IAAI;aACrB;SACF,CAAC;IACJ,CAAC;CACF"}

package/dist/service/cognito/command/auth/sim-cognito-password-response.d.ts

@@ -0,0 +1,31 @@
+import type { SimCognitoAuthSession } from "../../user-pool/auth/sim-cognito-auth-session.js";
+import type { SimCognitoUser } from "../../user-pool/user/sim-cognito-user.js";
+import type { SimCognitoFirstFactorResponseRequest } from "./sim-cognito-first-factor-response.js";
+import type { SimCognitoSignInCompletion } from "./sim-cognito-sign-in-completion.js";
+import type { SimCognitoAuthenticationOutput } from "./auth.command.js";
+interface SimCognitoPasswordResponseProperties {
+    readonly completion: SimCognitoSignInCompletion;
+}
+/**
+ * Signing in with the password a `USER_AUTH` challenge asked for.
+ *
+ * This is the same password check `USER_PASSWORD_AUTH` makes, reached the
+ * other way. A `PASSWORD` challenge is answered with it, and so is a
+ * `SELECT_CHALLENGE` whose `ANSWER` picked `PASSWORD`, which is the shape the
+ * Cognito documentation gives for choosing a password.
+ *
+ * A user that has registered a second factor is challenged for it afterwards,
+ * as it is on every other password sign-in. A wrong password leaves the
+ * challenge session standing, so the person can type it again.
+ */
+export declare class SimCognitoPasswordResponse {
+    private readonly completion;
+    constructor(properties: SimCognitoPasswordResponseProperties);
+    /**
+     * Check the password and finish, or answer with the second factor the user
+     * still owes.
+     */
+    complete(request: SimCognitoFirstFactorResponseRequest, session: SimCognitoAuthSession, user: SimCognitoUser): Promise<SimCognitoAuthenticationOutput>;
+}
+export {};
+//# sourceMappingURL=sim-cognito-password-response.d.ts.map

package/dist/service/cognito/command/auth/sim-cognito-password-response.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-password-response.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/command/auth/sim-cognito-password-response.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,kDAAkD,CAAC;AAE9F,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,0CAA0C,CAAC;AAC/E,OAAO,KAAK,EAAE,oCAAoC,EAAE,MAAM,wCAAwC,CAAC;AACnG,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,qCAAqC,CAAC;AACtF,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,mBAAmB,CAAC;AAExE,UAAU,oCAAoC;IAC5C,QAAQ,CAAC,UAAU,EAAE,0BAA0B,CAAC;CACjD;AAED;;;;;;;;;;;GAWG;AACH,qBAAa,0BAA0B;IACrC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAA6B;IAExD,YAAY,UAAU,EAAE,oCAAoC,EAE3D;IAED;;;OAGG;IACG,QAAQ,CACZ,OAAO,EAAE,oCAAoC,EAC7C,OAAO,EAAE,qBAAqB,EAC9B,IAAI,EAAE,cAAc,GACnB,OAAO,CAAC,8BAA8B,CAAC,CAezC;CACF"}

package/dist/service/cognito/command/auth/sim-cognito-password-response.js

@@ -0,0 +1,39 @@
+import { requireSimCognitoConfirmed, requireSimCognitoPasswordSet, requireSimCognitoSignIn, } from "../../user-pool/auth/sim-cognito-sign-in.js";
+import { SimCognitoTriggerOccasion } from "../../user-pool/trigger/sim-cognito-trigger-occasion.js";
+/**
+ * Signing in with the password a `USER_AUTH` challenge asked for.
+ *
+ * This is the same password check `USER_PASSWORD_AUTH` makes, reached the
+ * other way. A `PASSWORD` challenge is answered with it, and so is a
+ * `SELECT_CHALLENGE` whose `ANSWER` picked `PASSWORD`, which is the shape the
+ * Cognito documentation gives for choosing a password.
+ *
+ * A user that has registered a second factor is challenged for it afterwards,
+ * as it is on every other password sign-in. A wrong password leaves the
+ * challenge session standing, so the person can type it again.
+ */
+export class SimCognitoPasswordResponse {
+    completion;
+    constructor(properties) {
+        this.completion = properties.completion;
+    }
+    /**
+     * Check the password and finish, or answer with the second factor the user
+     * still owes.
+     */
+    async complete(request, session, user) {
+        requireSimCognitoSignIn(user, request.parameters.require("PASSWORD"));
+        requireSimCognitoConfirmed(user);
+        requireSimCognitoPasswordSet(user);
+        request.pool.auth.removeSession(session);
+        return await this.completion.challengeOrComplete({
+            pool: request.pool,
+            client: request.client,
+            user,
+            occasion: SimCognitoTriggerOccasion.tokenGeneration,
+            tokenClientMetadata: request.clientMetadata,
+            clientMetadata: request.clientMetadata,
+        });
+    }
+}
+//# sourceMappingURL=sim-cognito-password-response.js.map

package/dist/service/cognito/command/auth/sim-cognito-password-response.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-password-response.js","sourceRoot":"","sources":["../../../../../src/service/cognito/command/auth/sim-cognito-password-response.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,0BAA0B,EAC1B,4BAA4B,EAC5B,uBAAuB,GACxB,MAAM,6CAA6C,CAAC;AAErD,OAAO,EAAE,yBAAyB,EAAE,MAAM,yDAAyD,CAAC;AAUpG;;;;;;;;;;;GAWG;AACH,MAAM,OAAO,0BAA0B;IACpB,UAAU,CAA6B;IAExD,YAAY,UAAgD;QAC1D,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC,UAAU,CAAC;IAC1C,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,QAAQ,CACZ,OAA6C,EAC7C,OAA8B,EAC9B,IAAoB;QAEpB,uBAAuB,CAAC,IAAI,EAAE,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC;QACtE,0BAA0B,CAAC,IAAI,CAAC,CAAC;QACjC,4BAA4B,CAAC,IAAI,CAAC,CAAC;QAEnC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;QAEzC,OAAO,MAAM,IAAI,CAAC,UAAU,CAAC,mBAAmB,CAAC;YAC/C,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,IAAI;YACJ,QAAQ,EAAE,yBAAyB,CAAC,eAAe;YACnD,mBAAmB,EAAE,OAAO,CAAC,cAAc;YAC3C,cAAc,EAAE,OAAO,CAAC,cAAc;SACvC,CAAC,CAAC;IACL,CAAC;CACF"}

package/dist/service/cognito/command/auth/sim-cognito-password-sign-in.js

@@ -47,7 +47,7 @@ export class SimCognitoPasswordSignIn {
         requireSimCognitoConfirmed(user);
         requireSimCognitoPasswordSet(user);
         if (user.status.mustChangePassword) {
-            return this.challenge.issue({ pool, clientId: client.id, user });
+            return this.challenge.issue({ pool, client, user });
         }
         // A user that has registered a second factor is challenged for it here
         // rather than answered with tokens, which is what the pool's

package/dist/service/cognito/command/auth/sim-cognito-password-sign-in.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-password-sign-in.js","sourceRoot":"","sources":["../../../../../src/service/cognito/command/auth/sim-cognito-password-sign-in.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,0BAA0B,EAC1B,4BAA4B,EAC5B,uBAAuB,EACvB,2BAA2B,GAC5B,MAAM,6CAA6C,CAAC;AAGrD,OAAO,EAAE,yBAAyB,EAAE,MAAM,yDAAyD,CAAC;AA8BpG;;;;;;;;GAQG;AACH,MAAM,OAAO,wBAAwB;IAClB,YAAY,CAAyB;IACrC,UAAU,CAA6B;IACvC,SAAS,CAAiC;IAC1C,QAAQ,CAA6B;IAEtD,YAAY,UAA8C;QACxD,IAAI,CAAC,YAAY,GAAG,UAAU,CAAC,YAAY,CAAC;QAC5C,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC,UAAU,CAAC;QACxC,IAAI,CAAC,SAAS,GAAG,UAAU,CAAC,SAAS,CAAC;QACtC,IAAI,CAAC,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC;IACtC,CAAC;IAED;;;;;;;;;;;;OAYG;IACH,KAAK,CAAC,MAAM,CACV,OAA8B;QAE9B,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,cAAc,EAAE,GAAG,OAAO,CAAC;QAC7D,MAAM,QAAQ,GAAG,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;QAChE,MAAM,IAAI,GAAG,2BAA2B,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;QAEjE,MAAM,IAAI,CAAC,QAAQ,CAAC,iBAAiB,CAAC;YACpC,IAAI;YACJ,MAAM;YACN,IAAI;YACJ,cAAc;SACf,CAAC,CAAC;QAEH,uBAAuB,CAAC,IAAI,EAAE,UAAU,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC;QAC9D,0BAA0B,CAAC,IAAI,CAAC,CAAC;QACjC,4BAA4B,CAAC,IAAI,CAAC,CAAC;QAEnC,IAAI,IAAI,CAAC,MAAM,CAAC,kBAAkB,EAAE,CAAC;YACnC,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QACnE,CAAC;QAED,uEAAuE;QACvE,6DAA6D;QAC7D,4BAA4B;QAC5B,EAAE;QACF,yEAAyE;QACzE,uEAAuE;QACvE,8CAA8C;QAC9C,OAAO,MAAM,IAAI,CAAC,UAAU,CAAC,mBAAmB,CAAC;YAC/C,IAAI;YACJ,MAAM;YACN,IAAI;YACJ,QAAQ,EAAE,yBAAyB,CAAC,eAAe;YACnD,cAAc;SACf,CAAC,CAAC;IACL,CAAC;CACF"}
+{"version":3,"file":"sim-cognito-password-sign-in.js","sourceRoot":"","sources":["../../../../../src/service/cognito/command/auth/sim-cognito-password-sign-in.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,0BAA0B,EAC1B,4BAA4B,EAC5B,uBAAuB,EACvB,2BAA2B,GAC5B,MAAM,6CAA6C,CAAC;AAGrD,OAAO,EAAE,yBAAyB,EAAE,MAAM,yDAAyD,CAAC;AA8BpG;;;;;;;;GAQG;AACH,MAAM,OAAO,wBAAwB;IAClB,YAAY,CAAyB;IACrC,UAAU,CAA6B;IACvC,SAAS,CAAiC;IAC1C,QAAQ,CAA6B;IAEtD,YAAY,UAA8C;QACxD,IAAI,CAAC,YAAY,GAAG,UAAU,CAAC,YAAY,CAAC;QAC5C,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC,UAAU,CAAC;QACxC,IAAI,CAAC,SAAS,GAAG,UAAU,CAAC,SAAS,CAAC;QACtC,IAAI,CAAC,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC;IACtC,CAAC;IAED;;;;;;;;;;;;OAYG;IACH,KAAK,CAAC,MAAM,CACV,OAA8B;QAE9B,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,cAAc,EAAE,GAAG,OAAO,CAAC;QAC7D,MAAM,QAAQ,GAAG,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;QAChE,MAAM,IAAI,GAAG,2BAA2B,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;QAEjE,MAAM,IAAI,CAAC,QAAQ,CAAC,iBAAiB,CAAC;YACpC,IAAI;YACJ,MAAM;YACN,IAAI;YACJ,cAAc;SACf,CAAC,CAAC;QAEH,uBAAuB,CAAC,IAAI,EAAE,UAAU,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC;QAC9D,0BAA0B,CAAC,IAAI,CAAC,CAAC;QACjC,4BAA4B,CAAC,IAAI,CAAC,CAAC;QAEnC,IAAI,IAAI,CAAC,MAAM,CAAC,kBAAkB,EAAE,CAAC;YACnC,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QACtD,CAAC;QAED,uEAAuE;QACvE,6DAA6D;QAC7D,4BAA4B;QAC5B,EAAE;QACF,yEAAyE;QACzE,uEAAuE;QACvE,8CAA8C;QAC9C,OAAO,MAAM,IAAI,CAAC,UAAU,CAAC,mBAAmB,CAAC;YAC/C,IAAI;YACJ,MAAM;YACN,IAAI;YACJ,QAAQ,EAAE,yBAAyB,CAAC,eAAe;YACnD,cAAc;SACf,CAAC,CAAC;IACL,CAAC;CACF"}

package/dist/service/cognito/command/auth/sim-cognito-unsimulated-auth-options.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-unsimulated-auth-options.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/command/auth/sim-cognito-unsimulated-auth-options.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACV,gCAAgC,EAChC,0CAA0C,EAC1C,2BAA2B,EAC3B,qCAAqC,EACtC,MAAM,mBAAmB,CAAC;AAU3B;;;;;;;;;;;;;;;GAeG;AACH,qBAAa,gCAAgC;IAC3C,OAAO,CAAC,QAAQ,CAAC,eAAe,CAE9B;IACF,OAAO,CAAC,QAAQ,CAAC,aAAa,CAE5B;IACF,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAkD;IAC7E,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAEvB;IAEF,OAAO,CAAC,MAAM,CAAC,YAAY;IAW3B;;OAEG;IACH,qBAAqB,CAAC,KAAK,EAAE,gCAAgC,GAAG,IAAI,CAYnE;IAED;;;OAGG;IACH,qBAAqB,CACnB,KAAK,EAAE,0CAA0C,GAChD,IAAI,CAON;IAED;;OAEG;IACH,gBAAgB,CAAC,KAAK,EAAE,2BAA2B,GAAG,IAAI,CAYzD;IAED;;OAEG;IACH,gBAAgB,CAAC,KAAK,EAAE,qCAAqC,GAAG,IAAI,CAOnE;CACF"}
+{"version":3,"file":"sim-cognito-unsimulated-auth-options.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/command/auth/sim-cognito-unsimulated-auth-options.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACV,gCAAgC,EAChC,0CAA0C,EAC1C,2BAA2B,EAC3B,qCAAqC,EACtC,MAAM,mBAAmB,CAAC;AAU3B;;;;;;;;;;;;;;;GAeG;AACH,qBAAa,gCAAgC;IAC3C,OAAO,CAAC,QAAQ,CAAC,eAAe,CAE9B;IACF,OAAO,CAAC,QAAQ,CAAC,aAAa,CAE5B;IACF,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAkD;IAC7E,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAEvB;IAEF,OAAO,CAAC,MAAM,CAAC,YAAY;IAW3B;;OAEG;IACH,qBAAqB,CAAC,KAAK,EAAE,gCAAgC,GAAG,IAAI,CAcnE;IAED;;;OAGG;IACH,qBAAqB,CACnB,KAAK,EAAE,0CAA0C,GAChD,IAAI,CAON;IAED;;OAEG;IACH,gBAAgB,CAAC,KAAK,EAAE,2BAA2B,GAAG,IAAI,CAezD;IAED;;OAEG;IACH,gBAAgB,CAAC,KAAK,EAAE,qCAAqC,GAAG,IAAI,CAOnE;CACF"}

package/dist/service/cognito/command/auth/sim-cognito-unsimulated-auth-options.js

@@ -29,7 +29,9 @@ export class SimCognitoUnsimulatedAuthOptions {
     refuseInAdminInitiate(input) {
         SimCognitoUnsimulatedAuthOptions.refuseShared(this.adminInitiation, input);
         this.adminInitiation.refuse("ContextData", input.ContextData, "threat protection, which reads the caller's device and address");
-        this.adminInitiation.refuse("Session", input.Session, "continuing a USER_AUTH flow that offered a choice of factors");
+        this.adminInitiation.refuse("Session", input.Session, "carrying a sign-in already part way through into a fresh " +
+            "AdminInitiateAuth, where a challenge this simulation issued is " +
+            "answered through AdminRespondToAuthChallenge");
     }
     /**
      * Refuse an `AdminRespondToAuthChallenge` request this simulation cannot
@@ -45,7 +47,10 @@ export class SimCognitoUnsimulatedAuthOptions {
     refuseInInitiate(input) {
         SimCognitoUnsimulatedAuthOptions.refuseShared(this.initiation, input);
         this.initiation.refuse("UserContextData", input.UserContextData, "threat protection, which reads the caller's device and address");
-        this.initiation.refuse("Session", input.Session, "signing in directly from ConfirmSignUp");
+        this.initiation.refuse("Session", input.Session, "signing in directly from ConfirmSignUp, and carrying a sign-in " +
+            "already part way through into a fresh InitiateAuth, where a " +
+            "challenge this simulation issued is answered through " +
+            "RespondToAuthChallenge");
     }
     /**
      * Refuse a `RespondToAuthChallenge` request this simulation cannot honour.

package/dist/service/cognito/command/auth/sim-cognito-unsimulated-auth-options.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-unsimulated-auth-options.js","sourceRoot":"","sources":["../../../../../src/service/cognito/command/auth/sim-cognito-unsimulated-auth-options.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,0BAA0B,EAAE,MAAM,qCAAqC,CAAC;AAgBjF;;;;;;;;;;;;;;;GAeG;AACH,MAAM,OAAO,gCAAgC;IAC1B,eAAe,GAAG,IAAI,0BAA0B,CAC/D,mBAAmB,CACpB,CAAC;IACe,aAAa,GAAG,IAAI,0BAA0B,CAC7D,6BAA6B,CAC9B,CAAC;IACe,UAAU,GAAG,IAAI,0BAA0B,CAAC,cAAc,CAAC,CAAC;IAC5D,QAAQ,GAAG,IAAI,0BAA0B,CACxD,wBAAwB,CACzB,CAAC;IAEM,MAAM,CAAC,YAAY,CACzB,WAAuC,EACvC,KAAqC;QAErC,WAAW,CAAC,MAAM,CAChB,mBAAmB,EACnB,KAAK,CAAC,iBAAiB,EACvB,oBAAoB,CACrB,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,qBAAqB,CAAC,KAAuC;QAC3D,gCAAgC,CAAC,YAAY,CAAC,IAAI,CAAC,eAAe,EAAE,KAAK,CAAC,CAAC;QAC3E,IAAI,CAAC,eAAe,CAAC,MAAM,CACzB,aAAa,EACb,KAAK,CAAC,WAAW,EACjB,gEAAgE,CACjE,CAAC;QACF,IAAI,CAAC,eAAe,CAAC,MAAM,CACzB,SAAS,EACT,KAAK,CAAC,OAAO,EACb,8DAA8D,CAC/D,CAAC;IACJ,CAAC;IAED;;;OAGG;IACH,qBAAqB,CACnB,KAAiD;QAEjD,gCAAgC,CAAC,YAAY,CAAC,IAAI,CAAC,aAAa,EAAE,KAAK,CAAC,CAAC;QACzE,IAAI,CAAC,aAAa,CAAC,MAAM,CACvB,aAAa,EACb,KAAK,CAAC,WAAW,EACjB,gEAAgE,CACjE,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,gBAAgB,CAAC,KAAkC;QACjD,gCAAgC,CAAC,YAAY,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;QACtE,IAAI,CAAC,UAAU,CAAC,MAAM,CACpB,iBAAiB,EACjB,KAAK,CAAC,eAAe,EACrB,gEAAgE,CACjE,CAAC;QACF,IAAI,CAAC,UAAU,CAAC,MAAM,CACpB,SAAS,EACT,KAAK,CAAC,OAAO,EACb,wCAAwC,CACzC,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,gBAAgB,CAAC,KAA4C;QAC3D,gCAAgC,CAAC,YAAY,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QACpE,IAAI,CAAC,QAAQ,CAAC,MAAM,CAClB,iBAAiB,EACjB,KAAK,CAAC,eAAe,EACrB,gEAAgE,CACjE,CAAC;IACJ,CAAC;CACF"}
+{"version":3,"file":"sim-cognito-unsimulated-auth-options.js","sourceRoot":"","sources":["../../../../../src/service/cognito/command/auth/sim-cognito-unsimulated-auth-options.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,0BAA0B,EAAE,MAAM,qCAAqC,CAAC;AAgBjF;;;;;;;;;;;;;;;GAeG;AACH,MAAM,OAAO,gCAAgC;IAC1B,eAAe,GAAG,IAAI,0BAA0B,CAC/D,mBAAmB,CACpB,CAAC;IACe,aAAa,GAAG,IAAI,0BAA0B,CAC7D,6BAA6B,CAC9B,CAAC;IACe,UAAU,GAAG,IAAI,0BAA0B,CAAC,cAAc,CAAC,CAAC;IAC5D,QAAQ,GAAG,IAAI,0BAA0B,CACxD,wBAAwB,CACzB,CAAC;IAEM,MAAM,CAAC,YAAY,CACzB,WAAuC,EACvC,KAAqC;QAErC,WAAW,CAAC,MAAM,CAChB,mBAAmB,EACnB,KAAK,CAAC,iBAAiB,EACvB,oBAAoB,CACrB,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,qBAAqB,CAAC,KAAuC;QAC3D,gCAAgC,CAAC,YAAY,CAAC,IAAI,CAAC,eAAe,EAAE,KAAK,CAAC,CAAC;QAC3E,IAAI,CAAC,eAAe,CAAC,MAAM,CACzB,aAAa,EACb,KAAK,CAAC,WAAW,EACjB,gEAAgE,CACjE,CAAC;QACF,IAAI,CAAC,eAAe,CAAC,MAAM,CACzB,SAAS,EACT,KAAK,CAAC,OAAO,EACb,2DAA2D;YACzD,iEAAiE;YACjE,8CAA8C,CACjD,CAAC;IACJ,CAAC;IAED;;;OAGG;IACH,qBAAqB,CACnB,KAAiD;QAEjD,gCAAgC,CAAC,YAAY,CAAC,IAAI,CAAC,aAAa,EAAE,KAAK,CAAC,CAAC;QACzE,IAAI,CAAC,aAAa,CAAC,MAAM,CACvB,aAAa,EACb,KAAK,CAAC,WAAW,EACjB,gEAAgE,CACjE,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,gBAAgB,CAAC,KAAkC;QACjD,gCAAgC,CAAC,YAAY,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;QACtE,IAAI,CAAC,UAAU,CAAC,MAAM,CACpB,iBAAiB,EACjB,KAAK,CAAC,eAAe,EACrB,gEAAgE,CACjE,CAAC;QACF,IAAI,CAAC,UAAU,CAAC,MAAM,CACpB,SAAS,EACT,KAAK,CAAC,OAAO,EACb,iEAAiE;YAC/D,8DAA8D;YAC9D,uDAAuD;YACvD,wBAAwB,CAC3B,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,gBAAgB,CAAC,KAA4C;QAC3D,gCAAgC,CAAC,YAAY,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QACpE,IAAI,CAAC,QAAQ,CAAC,MAAM,CAClB,iBAAiB,EACjB,KAAK,CAAC,eAAe,EACrB,gEAAgE,CACjE,CAAC;IACJ,CAAC;CACF"}

package/dist/service/cognito/command/auth/sim-cognito-user-auth-sign-in.d.ts

@@ -0,0 +1,44 @@
+import type { SimCognitoUserPoolTriggers } from "../../user-pool/trigger/sim-cognito-user-pool-triggers.js";
+import type { SimCognitoAuthResolver } from "./sim-cognito-auth-resolver.js";
+import type { SimCognitoFirstFactorChallenge } from "./sim-cognito-first-factor-challenge.js";
+import type { SimCognitoPasswordSignIn, SimCognitoAuthRequest } from "./sim-cognito-password-sign-in.js";
+import type { SimCognitoAuthenticationOutput } from "./auth.command.js";
+interface SimCognitoUserAuthSignInProperties {
+    readonly authResolver: SimCognitoAuthResolver;
+    readonly challenge: SimCognitoFirstFactorChallenge;
+    readonly passwordSignIn: SimCognitoPasswordSignIn;
+    readonly triggers: SimCognitoUserPoolTriggers;
+}
+/**
+ * Choice-based sign-in, which is the `USER_AUTH` flow.
+ *
+ * The user says who it is and the pool answers with the factors it could sign
+ * in with, drawn from the pool's `AllowedFirstAuthFactors` and narrowed to the
+ * ones this user has. A request naming a `PREFERRED_CHALLENGE` is answered
+ * with that factor's challenge instead, and one carrying a `PASSWORD` outright
+ * is signed in there and then, which is what real Cognito does with all three.
+ * The pool's policy is what settles all three: a pool that allows no password
+ * first refuses one however the request sent it.
+ *
+ * This is the flow a passkey is presented through. It is also another way in
+ * for a password, and `USER_PASSWORD_AUTH` goes on being the direct one.
+ */
+export declare class SimCognitoUserAuthSignIn {
+    private readonly authResolver;
+    private readonly challenge;
+    private readonly passwordSignIn;
+    private readonly triggers;
+    constructor(properties: SimCognitoUserAuthSignInProperties);
+    /**
+     * Offer this user its factors, ask for the one it preferred, or sign it in
+     * with the password it already sent.
+     *
+     * `PreAuthentication` runs once the user is known, as it does for a password
+     * sign-in. A request carrying a password reaches it through the password
+     * sign-in body, which runs the trigger itself, so this one runs the trigger
+     * only where it is answering with a challenge.
+     */
+    handle(request: SimCognitoAuthRequest): Promise<SimCognitoAuthenticationOutput>;
+}
+export {};
+//# sourceMappingURL=sim-cognito-user-auth-sign-in.d.ts.map

package/dist/service/cognito/command/auth/sim-cognito-user-auth-sign-in.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-user-auth-sign-in.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/command/auth/sim-cognito-user-auth-sign-in.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,2DAA2D,CAAC;AAE5G,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AAC7E,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,yCAAyC,CAAC;AAC9F,OAAO,KAAK,EACV,wBAAwB,EACxB,qBAAqB,EACtB,MAAM,mCAAmC,CAAC;AAC3C,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,mBAAmB,CAAC;AAExE,UAAU,kCAAkC;IAC1C,QAAQ,CAAC,YAAY,EAAE,sBAAsB,CAAC;IAC9C,QAAQ,CAAC,SAAS,EAAE,8BAA8B,CAAC;IACnD,QAAQ,CAAC,cAAc,EAAE,wBAAwB,CAAC;IAClD,QAAQ,CAAC,QAAQ,EAAE,0BAA0B,CAAC;CAC/C;AAED;;;;;;;;;;;;;GAaG;AACH,qBAAa,wBAAwB;IACnC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAyB;IACtD,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAiC;IAC3D,OAAO,CAAC,QAAQ,CAAC,cAAc,CAA2B;IAC1D,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA6B;IAEtD,YAAY,UAAU,EAAE,kCAAkC,EAKzD;IAED;;;;;;;;OAQG;IACG,MAAM,CACV,OAAO,EAAE,qBAAqB,GAC7B,OAAO,CAAC,8BAA8B,CAAC,CA8BzC;CACF"}

package/dist/service/cognito/command/auth/sim-cognito-user-auth-sign-in.js

@@ -0,0 +1,62 @@
+import { requireSimCognitoReadyToSignIn, requireSimCognitoSignInUser, } from "../../user-pool/auth/sim-cognito-sign-in.js";
+import { requireSimCognitoAllowedPassword } from "./sim-cognito-available-challenges.js";
+/**
+ * Choice-based sign-in, which is the `USER_AUTH` flow.
+ *
+ * The user says who it is and the pool answers with the factors it could sign
+ * in with, drawn from the pool's `AllowedFirstAuthFactors` and narrowed to the
+ * ones this user has. A request naming a `PREFERRED_CHALLENGE` is answered
+ * with that factor's challenge instead, and one carrying a `PASSWORD` outright
+ * is signed in there and then, which is what real Cognito does with all three.
+ * The pool's policy is what settles all three: a pool that allows no password
+ * first refuses one however the request sent it.
+ *
+ * This is the flow a passkey is presented through. It is also another way in
+ * for a password, and `USER_PASSWORD_AUTH` goes on being the direct one.
+ */
+export class SimCognitoUserAuthSignIn {
+    authResolver;
+    challenge;
+    passwordSignIn;
+    triggers;
+    constructor(properties) {
+        this.authResolver = properties.authResolver;
+        this.challenge = properties.challenge;
+        this.passwordSignIn = properties.passwordSignIn;
+        this.triggers = properties.triggers;
+    }
+    /**
+     * Offer this user its factors, ask for the one it preferred, or sign it in
+     * with the password it already sent.
+     *
+     * `PreAuthentication` runs once the user is known, as it does for a password
+     * sign-in. A request carrying a password reaches it through the password
+     * sign-in body, which runs the trigger itself, so this one runs the trigger
+     * only where it is answering with a challenge.
+     */
+    async handle(request) {
+        const { pool, client, parameters, clientMetadata } = request;
+        if (parameters.find("PASSWORD") !== undefined) {
+            // A password sent outright skips the choice, so the pool's policy is
+            // read here rather than out of the factors the choice would have
+            // offered.
+            requireSimCognitoAllowedPassword(pool);
+            return await this.passwordSignIn.handle(request);
+        }
+        const username = this.authResolver.username(client, parameters);
+        const user = requireSimCognitoSignInUser(pool, client, username);
+        await this.triggers.preAuthentication({
+            pool,
+            client,
+            user,
+            clientMetadata,
+        });
+        requireSimCognitoReadyToSignIn(user);
+        const preferred = parameters.find("PREFERRED_CHALLENGE");
+        const offer = { pool, client, user };
+        return preferred === undefined
+            ? this.challenge.offer(offer)
+            : this.challenge.issue(offer, preferred, "PREFERRED_CHALLENGE");
+    }
+}
+//# sourceMappingURL=sim-cognito-user-auth-sign-in.js.map

package/dist/service/cognito/command/auth/sim-cognito-user-auth-sign-in.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-user-auth-sign-in.js","sourceRoot":"","sources":["../../../../../src/service/cognito/command/auth/sim-cognito-user-auth-sign-in.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,8BAA8B,EAC9B,2BAA2B,GAC5B,MAAM,6CAA6C,CAAC;AAErD,OAAO,EAAE,gCAAgC,EAAE,MAAM,uCAAuC,CAAC;AAgBzF;;;;;;;;;;;;;GAaG;AACH,MAAM,OAAO,wBAAwB;IAClB,YAAY,CAAyB;IACrC,SAAS,CAAiC;IAC1C,cAAc,CAA2B;IACzC,QAAQ,CAA6B;IAEtD,YAAY,UAA8C;QACxD,IAAI,CAAC,YAAY,GAAG,UAAU,CAAC,YAAY,CAAC;QAC5C,IAAI,CAAC,SAAS,GAAG,UAAU,CAAC,SAAS,CAAC;QACtC,IAAI,CAAC,cAAc,GAAG,UAAU,CAAC,cAAc,CAAC;QAChD,IAAI,CAAC,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC;IACtC,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,MAAM,CACV,OAA8B;QAE9B,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,cAAc,EAAE,GAAG,OAAO,CAAC;QAE7D,IAAI,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,SAAS,EAAE,CAAC;YAC9C,qEAAqE;YACrE,iEAAiE;YACjE,WAAW;YACX,gCAAgC,CAAC,IAAI,CAAC,CAAC;YAEvC,OAAO,MAAM,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACnD,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;QAChE,MAAM,IAAI,GAAG,2BAA2B,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;QAEjE,MAAM,IAAI,CAAC,QAAQ,CAAC,iBAAiB,CAAC;YACpC,IAAI;YACJ,MAAM;YACN,IAAI;YACJ,cAAc;SACf,CAAC,CAAC;QAEH,8BAA8B,CAAC,IAAI,CAAC,CAAC;QAErC,MAAM,SAAS,GAAG,UAAU,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;QACzD,MAAM,KAAK,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;QAErC,OAAO,SAAS,KAAK,SAAS;YAC5B,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC;YAC7B,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,EAAE,SAAS,EAAE,qBAAqB,CAAC,CAAC;IACpE,CAAC;CACF"}